CVE-2020-27212

CVSS V2 Medium 4.4 CVSS V3 High 7
Description
STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect access control. The flash read-out protection (RDP) can be degraded from RDP level 2 (no access via debug interface) to level 1 (limited access via debug interface) by injecting a fault during the boot phase.
Overview
  • CVE ID
  • CVE-2020-27212
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2021-05-21T12:15:07
  • Last Modified Date
  • 2021-06-08T19:17:26
Weakness Enumerations
CWE URL
CWE-74 http://cwe.mitre.org/data/definitions/74.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:o:st:stm32cubel4_firmware:*:*:*:*:*:*:*:* 1 OR 1.16.0
cpe:2.3:h:st:stm32l412c8:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l412cb:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l412k8:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l412kb:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l412r8:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l412rb:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l412t8:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l412tb:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l422cb:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l422kb:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l422rb:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l422tb:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l431cb:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l431cc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l431kb:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l431kc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l431rb:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l431rc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l431vc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l432kb:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l432kc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l433cb:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l433cc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l433rb:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l433rc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l433vc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l442kc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l443cc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l443rc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l443vc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l451cc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l451ce:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l451rc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l451re:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l451vc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l451ve:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l452cc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l452ce:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l452rc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l452re:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l452vc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l452ve:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l462ce:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l462re:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l462ve:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l471qe:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l471qg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l471re:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l471rg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l471ve:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l471vg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l471ze:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l471zg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l475rc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l475re:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l475rg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l475vc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l475ve:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l475vg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l476je:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l476jg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l476me:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l476mg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l476qe:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l476qg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l476rc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l476re:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l476rg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l476vc:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l476ve:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l476vg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l476ze:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l476zg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l486jg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l486qg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l486rg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l486vg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l486zg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l496ae:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l496ag:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l496qe:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l496qg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l496re:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l496rg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l496ve:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l496vg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l496wg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l496ze:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l496zg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l4a6ag:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l4a6qg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l4a6rg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l4a6vg:-:*:*:*:*:*:*:* 0 OR
cpe:2.3:h:st:stm32l4a6zg:-:*:*:*:*:*:*:* 0 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:L/AC:M/Au:N/C:P/I:P/A:P
  • Access Vector
  • LOCAL
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • PARTIAL
  • Base Score
  • 4.4
  • Severity
  • MEDIUM
  • Exploitability Score
  • 3.4
  • Impact Score
  • 6.4
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Attack Vector
  • LOCAL
  • Attack Compatibility
  • HIGH
  • Privileges Required
  • LOW
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • HIGH
  • Base Score
  • 7
  • Base Severity
  • HIGH
  • Exploitability Score
  • 1
  • Impact Score
  • 5.9
References
Reference URL Reference Tags
https://eprint.iacr.org/2021/640 Third Party Advisory
https://www.aisec.fraunhofer.de/en/FirmwareProtection.html Third Party Advisory
https://www.aisec.fraunhofer.de/de/das-institut/wissenschaftliche-exzellenz/security-and-trust-in-open-source-security-tokens.html Third Party Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2020-27212
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27212
History
Created Old Value New Value Data Type Notes
2022-05-10 07:12:16 Added to TrackCVE
2022-12-05 02:44:16 2021-05-21T12:15Z 2021-05-21T12:15:07 CVE Published Date updated
2022-12-05 02:44:16 2021-06-08T19:17:26 CVE Modified Date updated
2022-12-05 02:44:16 Analyzed Vulnerability Status updated